From ceeb469086226f835817bb96fca1143e6717c988 Mon Sep 17 00:00:00 2001 From: Chris Kim Date: Wed, 19 Jul 2023 17:08:17 -0700 Subject: [PATCH 1/2] add rancher-provisioning-capi Signed-off-by: Chris Kim --- ...cher-provisioning-capi-100.0.0+up0.0.1.tgz | Bin 0 -> 3415 bytes .../100.0.0+up0.0.1/Chart.yaml | 21 ++ .../100.0.0+up0.0.1/templates/NOTES.txt | 2 + .../100.0.0+up0.0.1/templates/_helpers.tpl | 18 + ...sterrole-capi-aggregated-manager-role.yaml | 11 + .../clusterrole-capi-manager-role.yaml | 323 ++++++++++++++++++ .../templates/clusterrole-cattle.yaml | 21 ++ ...rrolebinding-capi-manager-rolebinding.yaml | 14 + .../deployment-capi-controller-manager.yaml | 106 ++++++ .../100.0.0+up0.0.1/templates/hardened.yaml | 82 +++++ .../role-capi-leader-election-role.yaml | 26 ++ ...ding-capi-leader-election-rolebinding.yaml | 15 + .../service-capi-webhook-service.yaml | 15 + .../serviceaccount-capi-manager.yaml | 7 + .../100.0.0+up0.0.1/values.yaml | 25 ++ index.yaml | 26 ++ .../rancher-provisioning-capi/package.yaml | 5 + release.yaml | 2 + 18 files changed, 719 insertions(+) create mode 100644 assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/Chart.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/NOTES.txt create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/_helpers.tpl create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-aggregated-manager-role.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-manager-role.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-cattle.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrolebinding-capi-manager-rolebinding.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/deployment-capi-controller-manager.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/role-capi-leader-election-role.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/rolebinding-capi-leader-election-rolebinding.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/service-capi-webhook-service.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/serviceaccount-capi-manager.yaml create mode 100644 charts/rancher-provisioning-capi/100.0.0+up0.0.1/values.yaml create mode 100644 packages/rancher-provisioning-capi/package.yaml diff --git a/assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz b/assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..a1b8c78f920bb424db20450362be1726ad1b3f13 GIT binary patch literal 3415 zcmV-d4XE-TiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH+}Z`(Ms{o9{{(C$NkeU&V`{?R9(57$d`i{7?bBk3-1=q?Ic z8r!^3q>iNAq*;IWgG5QzPg`*uCk@O$5{slbLvm&~Gn|pY%w2#m1HqR>63z&ln=TGW z_jG}UvTm?XU);0Uwr!6FgZRH~+vWegVQ=)JHy8}Z!{K1m@4v8nqyD)60@?Qk+@^$5 zVe!JgH>~pHzLSC(;|eRnnRGe`xmaP!=a!3=qF@o;bwMaHBj7nGp_STh9+3gXHzvbA zIOsz6M3Wpcu!u*U;-x@d1SO5hqAzAN6F7Duf{GJZF>~(MuWRE>-U=2DRNLP?R z#Z~b_x!D$(zTP6_azDU|OevtRL@jFfx3l08Dhs6o>2$kuq88!Qa=D+*uA9fMJEeTu z^)X>xHxe|m8w;IIRHHCqAf(eV5%`!;2e}JDq;*C7zsXQSG-wAQJ@wP53H?I+&bFnH zJQOa(!`>6gY@2$vZP}LnzhMyl?{yxVo9|wl<^K}X5ad1%fNk=>KeEg6f7l-!<^LfH z@$noY$uA(_k|-{2G9K#sL_Q!6qT46HbYHU4hi0Zjzq zf~cEQilscqJ|HY5nKST^;(2^KLAhtVvK_cq0-v#E3-M3_{VQt&Kvx&ZeI5hamS zScMWzZ;%LCL@mx*P9xLIG;wr$i>wQ+rN%?++SLlpL7{+q(s=B-A4@y_|FQrYfRL67 zc2Whm@&9PhFY0d!@7gTT zx?F0I*6MKCYk?q4&5-dwvTN)#08k0pgR#a3m{H2Di79q19I6Eu z2W9CW(IrsIRc9#%L4O>;<85J;SG!a+I9HFFtlqT!ARDQMH{vA5~m4uLh z%mbXZWY&s|tCk?9xz;(T>^CKH{qQxCf=$q{=W!;j@|>DbIQi+M4z?=*E65%_ppbiP z#4JcK(@$aGS{ZYV_b0w9)LH%mRSZFU}Krw^nUWCmAmP&-K3PnS|CrnZ;*5Ny!;T^ff zrC7>(S@S)iUafA)(~pDt9yxm_$oYy5GIG-*K6UDN9+UC)9me|l!z3vjQV2mTFh8#c1g?MWUq38De#w1RzHxnXv?{re@*%7ive_L)tz zc`|LW-z$Ppe_$OJc&YBmpEGR{FE>9SLT>hNxSY+%+{eLv7Jo_o$h$~n} z#2bH>LJP^y{vY-F zy(9l0qU8A>2Z3C(`nzn`@6X~Wz3?>S8&3ySNvO!AjqTfcOa|a42`!YkSURZJK`4#8 z(}>rEG2LM)PT^80QC~NUfVXoYT;z-W@Ved5s8O| z-w67*_wODKa!9;#^lh5HgW}*; zNBh6Q;8h8X9_}kl7o1<262!7FYCN*wio2XT=+o(BD*(F|K*JmxMiziQveQ~dZ{Dl z=tloyO$bEh9!^VgOo33PhG-LhW%R~Dk>ytAF$bMQteTt(8=~zkv|3eoaGm^!Rx78{ ztneJIRwp@_X;NQ);-*OfdmzmCFszXr(Mx5ip}&+E1A=yVl6VKHU?EU*g`5QKY|;Bw|gM}EqVnhpwQUhV#A z7i@9CbX^XGJdqF=%-k5IG|gK?m`g*iDfr()e<7AE^Xv60m&AO2(0Wl{=#gz)X~cre zFC>^Y;91C($fG)HL^YpJTZ?JFLxyN+yg1Jzt1+|8i*@2fwm)(1MvQD6gj`Id$Vb;@ zZ=`u0>#)-{AdD?Av<9|55A#_e*F-A02T(qa^uIg7FwXheHMpV5p|%+aDA#KNqC!t4 zI;i9uuY1;|BH!LNzPQ#haxfp;TzYn;js3sC!UG20uHS;#V*d{Yb~*pY9*@UI`~MIn zZ~sptt9b1I_$Qy%c)J@3#*A;xOo@w@dXu4EawXs(XgPN2i$w?-3!uIw7v1P=HXIai zsmvsI`K5jegSo&SRJ)t{Le&gn%f@h!KHo#v1@ORoiKZ~)0?fENzKbQCWiE!zCjK4P z3)Of8+OJ5_(63XVS|hQGnwQhUd$ye_UIHSEzKf2Pr6q(#O^^TF`YA0D8 za|0EpB~kL*>G(ft9skEtHf)kdU)A=TI%>UtlR3ZP zM?zp&6IfJ}%rE+B2GQT!KMWiy9vfOkANnVL1?&$avGrET)l@?9k;#HS8zzg#X!7vs zE4;m5n1HoYG#rM2QzjoMSoi&o}OtzWY*`te}oWW za{)5TNsjBFTBXnQPd5Q%_3!nY$Bf1UW7cOMbXS|$K*jsNKlD*3<1 z?|&Yq-0{%Zdm4TnMYX=_+x28^5t>>bTFkld60hTyG}9Q}-QpurUEpUa2(cKUm_&u{ zvj1)QzYzFSw`m&!fVT1fs5h*{|BQ~`|2Rn5f&U*O@Mi->wU-9Fsg%_Sp<0>rOv8iP z@PBsQQF8~<#wWNv{;wSWI~a|R{C|+L$vW99hnMK4HCNX-{1|{|;`sJ0_eE@dTW2=1.23.0-0' + catalog.cattle.io/namespace: cattle-provisioning-capi-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: apps.deployment/v1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0' + catalog.cattle.io/release-name: rancher-provisioning-capi +apiVersion: v1 +appVersion: 1.4.4 +description: capi-controller-manager compatible with Rancher Provisioning +home: https://github.com/rancher/provisioning/blob/main/charts/capi/ +maintainers: +- email: chris.kim@suse.com + name: Chris Kim +name: rancher-provisioning-capi +sources: +- https://github.com/rancher/provisioning/blob/main/charts/capi/ +version: 100.0.0+up0.0.1 diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/NOTES.txt b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/NOTES.txt new file mode 100644 index 0000000000..2070555e03 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/NOTES.txt @@ -0,0 +1,2 @@ +{{ $.Chart.Name }} has been installed. Check its status by running: + kubectl --namespace {{ .Release.Namespace }} get pods" \ No newline at end of file diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/_helpers.tpl b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/_helpers.tpl new file mode 100644 index 0000000000..d46154c543 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/_helpers.tpl @@ -0,0 +1,18 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-aggregated-manager-role.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-aggregated-manager-role.yaml new file mode 100644 index 0000000000..760c5f9a63 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-aggregated-manager-role.yaml @@ -0,0 +1,11 @@ +aggregationRule: + clusterRoleSelectors: + - matchLabels: + cluster.x-k8s.io/aggregate-to-manager: "true" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-aggregated-manager-role +rules: [] diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-manager-role.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-manager-role.yaml new file mode 100644 index 0000000000..d3d02e51a0 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-capi-manager-role.yaml @@ -0,0 +1,323 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + cluster.x-k8s.io/aggregate-to-manager: "true" + cluster.x-k8s.io/provider: cluster-api + name: capi-manager-role +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - addons.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - addons.cluster.x-k8s.io + resources: + - clusterresourcesets/finalizers + - clusterresourcesets/status + verbs: + - get + - patch + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - apiGroups: + - bootstrap.cluster.x-k8s.io + - controlplane.cluster.x-k8s.io + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - bootstrap.cluster.x-k8s.io + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusterclasses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusterclasses + - clusterclasses/status + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + verbs: + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/finalizers + - clusters/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + - machinedeployments/finalizers + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + - machinedeployments/finalizers + - machinedeployments/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinehealthchecks + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinehealthchecks + - machinehealthchecks/finalizers + - machinehealthchecks/status + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinepools + - machinepools/finalizers + - machinepools/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machines/finalizers + - machines/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machines/status + verbs: + - delete + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinesets + verbs: + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinesets + - machinesets/finalizers + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinesets + - machinesets/finalizers + - machinesets/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - patch + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - watch + - apiGroups: + - ipam.cluster.x-k8s.io + resources: + - ipaddressclaims + verbs: + - get + - list + - watch + - apiGroups: + - runtime.cluster.x-k8s.io + resources: + - extensionconfigs + - extensionconfigs/status + verbs: + - get + - list + - patch + - update + - watch diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-cattle.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-cattle.yaml new file mode 100644 index 0000000000..5beeafddab --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrole-cattle.yaml @@ -0,0 +1,21 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: provisioning-rke-cattle-io + labels: + cluster.x-k8s.io/aggregate-to-manager: "true" +rules: + - apiGroups: ["rke.cattle.io"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: provisioning-rke-machine-cattle-io + labels: + cluster.x-k8s.io/aggregate-to-manager: "true" +rules: + - apiGroups: ["rke-machine.cattle.io"] + resources: ["*"] + verbs: ["*"] diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrolebinding-capi-manager-rolebinding.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrolebinding-capi-manager-rolebinding.yaml new file mode 100644 index 0000000000..2fb193d4ac --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/clusterrolebinding-capi-manager-rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: capi-aggregated-manager-role +subjects: + - kind: ServiceAccount + name: capi-manager + namespace: "{{ .Release.Namespace }}" diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/deployment-capi-controller-manager.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/deployment-capi-controller-manager.yaml new file mode 100644 index 0000000000..edfd66fd71 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/deployment-capi-controller-manager.yaml @@ -0,0 +1,106 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + control-plane: controller-manager + name: capi-controller-manager + namespace: "{{ .Release.Namespace }}" +spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: cluster-api + control-plane: controller-manager + template: + metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + control-plane: controller-manager + spec: + containers: + - command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid +{{- if .Values.extraEnv }} +{{ toYaml .Values.extraEnv | indent 12 }} +{{- end }} + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + args: + - --leader-elect +{{ toYaml .Values.args | indent 12 }} + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: capi-manager + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + secretName: capi-webhook-service-cert + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} + {{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 6 }} + {{- else }} + - effect: NoSchedule + key: node-role.kubernetes.io/controlplane + value: "true" + - effect: NoSchedule + key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + - effect: NoSchedule + key: "node-role.kubernetes.io/master" + operator: "Exists" + - effect: "NoExecute" + key: "node-role.kubernetes.io/etcd" + operator: "Exists" + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml new file mode 100644 index 0000000000..933dfb86a7 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml @@ -0,0 +1,82 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: rancher-provisioning-capi-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: rancher-provisioning-capi-patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + metadata: + name: rancher-provisioning-capi-patch-sa + labels: + app: rancher-provisioning-capi-patch-sa + spec: + serviceAccountName: rancher-provisioning-capi-patch-sa + securityContext: + runAsNonRoot: true + runAsUser: 1000 + restartPolicy: Never + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} + containers: + - name: patch-sa-{{ .Release.Namespace }} + image: {{ template "system_default_registry" $ }}{{ $.Values.global.kubectl.repository }}:{{ $.Values.global.kubectl.tag }} + imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", "{{ .Release.Namespace }}"] +--- +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: rancher-provisioning-capi-patch-sa + labels: + app: rancher-provisioning-capi-patch-sa +rules: + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: ['get', 'patch'] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-provisioning-capi-patch-sa + labels: + app: rancher-provisioning-capi-patch-sa +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rancher-provisioning-capi-patch-sa +subjects: + - kind: ServiceAccount + name: rancher-provisioning-capi-patch-sa + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-provisioning-capi-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: rancher-provisioning-capi-patch-sa +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/role-capi-leader-election-role.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/role-capi-leader-election-role.yaml new file mode 100644 index 0000000000..d1b53aafc5 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/role-capi-leader-election-role.yaml @@ -0,0 +1,26 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-leader-election-role + namespace: "{{ .Release.Namespace }}" +rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/rolebinding-capi-leader-election-rolebinding.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/rolebinding-capi-leader-election-rolebinding.yaml new file mode 100644 index 0000000000..28c91de659 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/rolebinding-capi-leader-election-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-leader-election-rolebinding + namespace: "{{ .Release.Namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: capi-leader-election-role +subjects: + - kind: ServiceAccount + name: capi-manager + namespace: "{{ .Release.Namespace }}" diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/service-capi-webhook-service.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/service-capi-webhook-service.yaml new file mode 100644 index 0000000000..109b368d4b --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/service-capi-webhook-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-webhook-service + namespace: "{{ .Release.Namespace }}" + annotations: + need-a-cert.cattle.io/secret-name: capi-webhook-service-cert +spec: + ports: + - port: 443 + targetPort: webhook-server + selector: + cluster.x-k8s.io/provider: cluster-api diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/serviceaccount-capi-manager.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/serviceaccount-capi-manager.yaml new file mode 100644 index 0000000000..afba516203 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/serviceaccount-capi-manager.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + name: capi-manager + namespace: "{{ .Release.Namespace }}" diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/values.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/values.yaml new file mode 100644 index 0000000000..0be412e186 --- /dev/null +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/values.yaml @@ -0,0 +1,25 @@ +image: + repository: rancher/mirrored-cluster-api-controller + tag: v1.4.4 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + kubectl: + repository: rancher/kubectl + tag: v1.20.2 + pullPolicy: IfNotPresent + +# tolerations for the capi-controller-manager deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info +tolerations: [] + +nodeSelector: {} + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +extraEnv: [] +args: + - "--metrics-bind-addr=localhost:8080" + - "--feature-gates=MachinePool=false,ClusterResourceSet=false,ClusterTopology=false,RuntimeSDK=false,LazyRestmapper=false" diff --git a/index.yaml b/index.yaml index c5f7382bc4..0a1a7f88ac 100755 --- a/index.yaml +++ b/index.yaml @@ -13544,6 +13544,32 @@ entries: urls: - assets/rancher-prometheus-adapter/rancher-prometheus-adapter-2.12.101.tgz version: 2.12.101 + rancher-provisioning-capi: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Rancher Provisioning CAPI Controller Manager + catalog.cattle.io/kube-version: '>=1.23.0-0' + catalog.cattle.io/namespace: cattle-provisioning-capi-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: apps.deployment/v1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0' + catalog.cattle.io/release-name: rancher-provisioning-capi + apiVersion: v1 + appVersion: 1.4.4 + created: "2023-07-24T13:05:39.150204-07:00" + description: capi-controller-manager compatible with Rancher Provisioning + digest: a750fa212369dbe092f1d5731ac568d160d14844c7e392a55e61b4e757e0821c + home: https://github.com/rancher/provisioning/blob/main/charts/capi/ + maintainers: + - email: chris.kim@suse.com + name: Chris Kim + name: rancher-provisioning-capi + sources: + - https://github.com/rancher/provisioning/blob/main/charts/capi/ + urls: + - assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz + version: 100.0.0+up0.0.1 rancher-pushprox: - annotations: catalog.cattle.io/hidden: "true" diff --git a/packages/rancher-provisioning-capi/package.yaml b/packages/rancher-provisioning-capi/package.yaml new file mode 100644 index 0000000000..40d9afaf11 --- /dev/null +++ b/packages/rancher-provisioning-capi/package.yaml @@ -0,0 +1,5 @@ +url: https://github.com/rancher/provisioning.git +commit: ddba2c23cd70016f002448fd801d96aa9375782e +subdirectory: charts/capi +version: 100.0.0 + diff --git a/release.yaml b/release.yaml index b1964716fb..b330229016 100644 --- a/release.yaml +++ b/release.yaml @@ -50,5 +50,7 @@ rancher-monitoring-crd: - 102.0.2+up40.1.2 rancher-project-monitoring: - 0.3.0+up0.3.3 +rancher-provisioning-capi: +- 100.0.0+up0.0.1 rancher-webhook: - 2.0.6+up0.3.6-rc2 From 2f2619e49090e6213697abaa98a1b8ecd80ab442 Mon Sep 17 00:00:00 2001 From: Chris Kim Date: Tue, 25 Jul 2023 13:26:50 -0700 Subject: [PATCH 2/2] make charts Signed-off-by: Chris Kim --- ...cher-provisioning-capi-100.0.0+up0.0.1.tgz | Bin 3415 -> 3419 bytes .../100.0.0+up0.0.1/Chart.yaml | 1 + .../100.0.0+up0.0.1/templates/hardened.yaml | 1 - index.yaml | 5 +++-- 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz b/assets/rancher-provisioning-capi/rancher-provisioning-capi-100.0.0+up0.0.1.tgz index a1b8c78f920bb424db20450362be1726ad1b3f13..3a408e613d38e1b5668547a68f8ca4cbc2e8d615 100644 GIT binary patch delta 3356 zcmV+%4de3H8rvF>MGEllLx6piEIW?Vkxw6gNJ-XDTX7sGEzCa>i=;S1a%MO)oRPrH zn}e`I!52gl&Ip@X9u7(GY>tJpZ*f3hJg_*9M9XI zx3OWsNaLG9~Yx`+}M-PE>* zAOfPKmGyf0g)pCgk@dY}z&=Q8wh%6V!eJ=8ko=wwy6AUs7-o-sduR_kK1ffHQ0XeYP+qo+R$z7!c{~WQA`=Se3sLi0 z66nl%jLKZ8P`bU|jHr1uu{|E7v+L!t>rE)1^a4y+&x>V|>}k2wiE9)l41{!lI~IZf z6Y3&wE{L?RN$@urNr(sSAY`U~7B`_^NYL4|6p}~613l~mk<7NK?>M$&JO3Mn@&A73 zsTsahn&tlj(+K1)4uDPae=u^&^8ds+J;?uk6cXSW#FAe?$R$x++-3~Y3y2V0fNyy; zk_v=Xc87bviT3CzvM3jG`JWLPqGm zg(;4xx`Y{#D#oE3OZ`~Jdy1Nlbr>ccbbE@+z_ACqB5cIu2c$R!Va`1?W#B zaJJDEKqeYu;DUhysZT)e$)3lV2ceQZ>CM59Xv|HpAYKfp7Yi+AVdh(ZE9gB9J>UWm zVN>48;pL)Fe|9>I`)~ymJjI2J?v|a-4?m!>AY2f2dq%O87dQZfr6e;3K2ki7ZznAG z)GOP88zt~LTWAPBq|V}ty6`lrK^{69TC86D*RKFZx4 z`q4I~o|YraC7NT2CIAc(CKaX>d>ft3!MjF8NhB3kkwlYQBqA1nQ;WNj)5x+iH5=XC zA^Xy(pn7OiyIi6fC=_yEcAt9ghtiJ!KhJ@NAf&CrtyIBH{688Fiu^xtM#F>tx0iBv zXCWV^gaPUrP3*I8RI$$@(Z#yRS}r?rM>0kB@5U@Jx?E~)*6MKCYoQ=aO;PuMWUsr` z06-;V58V|$!2HU8?@oS3+7`EB6)LB4Ni%?jt|8Vl^EQ60+-SSUP2PO$BUJ+?)iTrOuMbnkcld1a42e!D<4CCq{rR=HvFGx|AJF6eiA&J35fMR zKh=?~xUtDr+{FLGEBW%gei)!~}abj?|nB@>L^YCqpdyoom8;7oDxJ=>(v# zj}?wV(;N~N1QHLMa8b^3&HO>@Xt*OH3dZz$>aE#J*^2+$FnzA9=l}j-cv|xR3{ITm z!}-6LvJY;5Tq_Q?<=+~n)t(6)lAi^S!c0C{#+8JSfXuy{wq(|d)Kv=*lU(ZzRQ8(^ zxqA2#OTi{+*!MY;c6m-sC>;HCR0rD=fE8qqK2XR#Hewbgn3<<2^z(!4675tbq%ELi zZ%P=ZOzLqD3EU`PF&RsH1LBc?R6Ix+b{q zhPE|-8(HY~EDxFl(U5am!CqIcnVo6>b_ujHp>>n}&L-MCnYP&P6hWvzu=WeQRQK%9 znYM_Ro1YOOH~Tj{&ZcA*;P4@fza?x~wA7#;7Y)Y!XJTJh4JFWQt zkDX)Z;Q!x8*^&R>IOYpPB(76xu{0ZRe??I1-AA9g;u==r?%h92q5^&D{*+W2zE3JF z%i7f)WW%fzHR17RpF-MV71I5`C;v|f^Rsk`{1r^nP%9WV@&C!msC@r_Iyl__?WJsg z&k27wJHFFP`5KDq#J?|L8V{P%{~A;~2vvEu)y2PzCjSOcC9Gx!xdO2u9=!299x}wj9zZT|0_?L)es`TULV-N|D(alX^HOxoDKna5;*2wsxVLWzf^i~1de(zrW=cug47J?7GGHYxuk z5OYfy7rH5iY907?2q2U$MfygXG?$KIA&&iPAIU;k^lkqhObYMWW?DqY6?WtlQFVjt_#{%<%uE`c$_eSyiG z^J`0jSQJLpBMYv$$Ek}xo{cwu0&r>pG|aJKWC7SGTdigM=55=hl;A}=CyX-%H>Dvl zrToiSkOiSIgLCO&icRLP&cG`4^>BzMgc3zSmJ#y>533Yzp*Qc}cZzF~fb#1gh={$B ziOx4VIXNCwTYrImXm!(=@bguUxm(kfCyFaD>0H6ak0dpIr0 zF$F@E8sbg(mC;)l#g}FY2}J_;eKkVVW|3e-_w-F$lu_EATk;<0C(1M?(jNGp~04j0?87V5TmILY_#7 z2Uc#3Qkv!+BFv+a-xU0BqrVVKmig6cl}lniKWM$EFZ9SZt~6pn<`)u78}KaTO5{-; zHKLl&r>(^_-yuV^G@j1$$ZD)C^J0~Fk?oJp-O$MDAmm~qMLxQJE_)-*>sW=IwgJ)I z0K;fttMf3Q6>>wQk~;tu;8_2=7mV%&KfeJlQaRMt0|DjvEkIQ0sYC~reB)Kmx>V%5 zyT%t+T1F1$Q=3cQU1?+g&#~}O?9vyD5bDl>2DY5{;1ur!OE}A14C_t&d#o3#@d&hEk)okr zr$DtvVjDFtr-k<&Csn)z#Ehj`I8Y)gpqU5*J z@qaWr{*R?>*d&j>s_i#*G$DVDnSRwLY|%bKxgm#|>$w8r|*UBT-%8XDJA=7@?R%g>JL|ZTY_t_*1uO zYXX2a@&BlQQi=Z=9=`vvm$C)_KStos8j5N!4YpG&s}VxAGU+=F4{F2z*>y+F9Y`CW z;O6*$zjFNVaCCCu|GkuT7RpXJyhJyxxw^*T#{hf_>)W^7=dR6doz)D|T-U8ki!5%y zN^Z(mQ348!87OnNUx^VYh7z@0i>Kb_rg9JdPn;2j*xy!H0-N}MFs$(Z$#8Js|9zDE mdMI`j;oF-1pL%@`^Z+_TuWZI1?n_`hx2<^R25Z}g%!7!1e5;b7G7 zzp#6w{uS6|s_qVg)5h@F%0_k+S zbD|dE)N;9>&aRust~;fC+VwGET{jXmvKtGXPE?~XVIZW_F%kHfPzSjSL8NtmMf|_X zP(n0l2O&N6)2IpkLj2CQrI0)nF2uv$6Ul6wdbVxZmi@nB5dH6U9-Eu*UYh0q64Mam zJ`R9w^1nZ_%kqEN9~|ZXAqw&F93sgtAmEZHE^aa&>iR?oF2FNg8cGGiEQ*H?LJH3# zxe`kfgyO*_A*B;eiF@Oq_p@_U=h-C`5nw~NYw?*iBu5| zhS5PNItE-tb;mjklMZovic8U4hi0Zjzqf~cEQilscqJ|HY5nKST^;(2^KLAhtVvK_cq0-v#E z3;xXo22$4WQzE3`R3wp8xvk?9x)#YDXAbdA0Swt<)T23R=%rtR-bbE`e3$3NbL+jer z3e7>GfP2z-?71IHJO2N&02+XhmI`)K1-J44XwWb6f8QRBj{4t0%I&R*JeUy%$k3YD z7f-8VUqqsd8OU6%I#EY5L)P!wEYP}KYLM3IaM^2tAWY4W@jtR_>@)yS3E6|O#s`>J z`Q6FSC^py4NQKIOsa#SIV4^FC^vt{)AX08(yT?i1jVfR^16Mi7IOmsItAnVT2hn(u zQf8d}C&bifg@#O2IgLY6gIv2I@*_R${H2Di79q19I6Eu2W9CW(IrsIRc9#%L4O>;<8 z5J;SG!a+I9HFFtlqT!ARDQMH{vA5w)gG@e|+LeTmfXoA&wq(|djH{L)rn%NRsO&c-a{cf%l7dap zu;+0mt@50jP&oPNqz<+#04vBIJ)n?#Y{V=`Fw;+A;N=I|C)%k@NLxV3?u;-@$u|&k zV>fLq%nbhMR5V%&rA~KfN7Q{oTxSuw}8XAdzwZi>Tz?5?(mB2y$YQ|V-FJnM4 zgXUg@%>UbWL@%0_X`ugNqpkLoqCd8-1wfCAvL$B|b7#D!4TDS{vubv0~4Q(4Xve4~G z9yAGmq5m~nN75LGHtQnD}qpeU>z2CsqV?2Gi?zsH$Ndl zZuW1uoXyDG$H9FTe@ED`Y^gy#EE_o$h$~n}#2bH>L9|wV4v--Pi*YD5bD82AB z;~P&0RY|DGq>b&{c}xc2CJ8N+xL7)WsMkR#jl0u`*Mu?MVJ_`vlk!gjF}H+Kq1$4p zHi2)407B_fq;I5ob?GQ3a=Gtg=B=xAbvHkXF2I)MUV6VKzrOo&{`TY9<>c+@S)oS~ zOZgAMeW%ob(2M}}61iU6HohlSq=`nUJ*9u9IyymItyn!ba7;^0@L z_`k4EtF3<_!aQIK_4+6mCc9eYAXjp>V%ADViW{v`mzc}e15mOA22xH0pF(j?3#Ede zL6s*O#PjQFzy7y!BNxg+)i%A@Rl1D&%Q9tV#6F2f`@g~9RSAq9?kh|eoL`v|#Ii7I zJhI@5yPP`c)9GX@0J|1I!yFrbMiziQveQ~dZ{Dl=tloyO$bEh9!^Vta!i3xrG{t| zer5E=L6PNF<}nAIM68;e3LB#BEwoxycyOKkh*m47(yZ_ttyU*Fm}yd9e&VJ{0ec|K z_%N)I9MMZ9$d$;WI%-5UpHEwh zX}&{-XlcAS&m*fbv&@Ti;zhPUaqdQpY#fAKOr*$1*JW>{c^&J2u+ugmj4d#<2DUyA z^I0L+L@K!lP(F_IzdOM&&iUCjxS`6SwiyU0*J}ZyLQf?+sN@^3d)B2Q-`+O9xYjaq zFdy4odUmCa{lCD%0|wr%--6g;{|^RsIseBVkH<&*{}3f_|4$>UcEzKf2Pr6q(#O^^TF`YA0EL9diQ}rzKJH+v)f}Y90T_ zQZ{UoM_<+Un>uQ}f0H@C;pHH2(&xrVokHldk#sd)A|qal=tn|eSQA)OlguyrX$H~X z+dm8(DjpkJMIZVneg*6gBeC^X$<Oc6w19S}yPcN8vdtM+-j;0fOTeGpF!4bt&-70> z0c7>>^_$7lnSOX|73@(<8~uNs_?veh5zbmB0B?||}jE>*`I7r!n{~sdoX9GpGmj=73l+_5KTAB1r!-LxJe|Ftba|hDKC%8TS zuN?n>I~a|R{C|+L$vW99hnMK4HCNX-{1|{|;`sJ0_eE@dTW2=1.23.0-0' catalog.cattle.io/namespace: cattle-provisioning-capi-system catalog.cattle.io/os: linux diff --git a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml index 933dfb86a7..c56951b43d 100644 --- a/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml +++ b/charts/rancher-provisioning-capi/100.0.0+up0.0.1/templates/hardened.yaml @@ -29,7 +29,6 @@ spec: command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] args: ["-n", "{{ .Release.Namespace }}"] --- ---- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/index.yaml b/index.yaml index 0a1a7f88ac..8fb14dba1e 100755 --- a/index.yaml +++ b/index.yaml @@ -13548,6 +13548,7 @@ entries: - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/display-name: Rancher Provisioning CAPI Controller Manager + catalog.cattle.io/hidden: "true" catalog.cattle.io/kube-version: '>=1.23.0-0' catalog.cattle.io/namespace: cattle-provisioning-capi-system catalog.cattle.io/os: linux @@ -13557,9 +13558,9 @@ entries: catalog.cattle.io/release-name: rancher-provisioning-capi apiVersion: v1 appVersion: 1.4.4 - created: "2023-07-24T13:05:39.150204-07:00" + created: "2023-07-25T15:13:25.7396-07:00" description: capi-controller-manager compatible with Rancher Provisioning - digest: a750fa212369dbe092f1d5731ac568d160d14844c7e392a55e61b4e757e0821c + digest: 40721dd822b35c4e8c8de0117f0989334a5dd4b19dfb274f6ffd52f8bb8fd7f0 home: https://github.com/rancher/provisioning/blob/main/charts/capi/ maintainers: - email: chris.kim@suse.com